Ciphertext domain direct-readable lossless information hiding method and system based on LWE

Abstract

The invention discloses an LWE-based ciphertext domain direct-readable lossless information hiding method and system, and the method comprises the following steps: obtaining a ciphertext image, decrypting the ciphertext image through employing an LWE algorithm, and obtaining a quantization vector used for plaintext mapping; performing redundancy analysis on the value domain of the quantization vector; based on a redundancy analysis result, performing lossless embedding on the ciphertext image to obtain a cipher-carrying ciphertext; and based on the secret-carrying ciphertext, extracting information from the ciphertext image or decrypting the ciphertext image to obtain a lossless plaintext image. According to the method, the accuracy is high and the security is good through the LWE encryption and decryption and the ciphertext embedding extraction process.

Description

Technical Field

[0001] The present invention belongs to the field of information hiding, and in particular relates to a method and system for directly readable lossless information hiding in a ciphertext domain based on LWE. Background Art

[0002] Reversible data hiding in encryption domain (RDH-ED) can perform encryption to achieve privacy protection of media and embed additional data for covert communication or access control. RDH-ED is suitable for multimedia privacy protection, ciphertext retrieval, and access control in the cloud. The cryptographic system introduced by RDH-ED has evolved from symmetric cryptographic system to public key cryptographic system, enriching the application scenarios of RDH-ED.

[0003] RDH-ED based on symmetric encryption is the main focus of research in this field. The introduced symmetric encryption is mainly focused on image encryption, with the goal of protecting the confidentiality of image content during transmission. RDH-ED allows embedding additional data without compromising the decryption quality. It is mainly used for image management in the cloud and access control during retrieval.

[0004] Puteaux first introduced the AES cipher into RDH-ED, while Zhang proposed a RDH-ED method based on a stream cipher. Separable RDH-ED was subsequently proposed to support plaintext decryption and data extraction as independent operations. Separability has become an important indicator of practicality. To enhance the embedding capacity (EC), Puteaux proposed to exploit the prediction error before encryption. Another embedding framework that maintains relevance after encryption is achieved by reusing the encryption key within the pixel block. Yin further exploited pixel prediction and rearrangement of multiple MSB planes to enhance EC. To obtain higher EC, adaptive prediction error labels and classification methods based on local correlation were introduced. An adaptive embedding RDH-ED scheme combining LBE and IBBE is proposed to achieve high capacity.

[0005] Public key cryptography (PKC) is widely used in identity authentication and key protocols in network communications and multimedia transmission, and thus plays a wider role in network security, trusted Internet and online transactions. PKC-based RDH-ED allows any untrusted third party, such as a web page or cloud server, to embed watermarks or identity information in the ciphertext, thereby achieving active forensics and access control of encrypted data. In recent years, PKC-based RDH-ED algorithms have received increasing attention. PKC based on RDH-ED mainly includes Paillier encryption and learning with errors (LWE) encryption.

[0006] In order to achieve embedding in ciphertext, it is necessary to reserve embedding space. However, given that the reserved space in the above algorithm is independent of the encryption process, the encryption security will be limited by the embedding preprocessing, which leads to inconsistent security between encryption and embedding. In order to achieve consistent security, Ke proposed RDH-ED based on redundancy reservation in encryption (VRIE) in 2016. He initially proposed to use LWE cipher for embedding and divide the LWE encryption domain into different regions. By establishing embedding coding and message mapping rules, additional data can be embedded during LWE encryption. Subsequently, Ke et al. proposed a multi-level embedding RDH-ED algorithm with high EC. However, there is a partial overlap between the embedded key and the private key, which impairs the separability. Wu proposed a method to embed data during the encryption process of the NTRU system, which has high security, but cannot support the direct reading of embedded information from the ciphertext, and certain decryption operations are required before extraction. In the literature, fully homomorphic encryption (FHE) is used to improve separability, and a method of fully homomorphic encryption encapsulation difference extension (FHEE-DE) is proposed. Although it has achieved good performance in terms of security, reversibility, and separability, FHEE-DE has a high computational complexity, which is its disadvantage. Effectively reducing the computational complexity of the embedding operation is an important way to improve it.

[0007] In summary, the RDH-ED algorithm under the current public key system is still the focus of research in this field. The symmetric encryption algorithm is mainly embedded in the image carrier, and its application scenario is not universally applicable. The method of retaining pixel features in the ciphertext image is a weakening of the security of image encryption. How to achieve lossless embedding in the public key encryption system, that is, how to decrypt the embedded ciphertext without loss, is still a technical difficulty in this field. Second, there are few RDH-ED algorithms that can directly read information from the ciphertext, that is, they do not rely on the decryption key and decryption process. The algorithm that continuously refreshes the ciphertext through key replacement technology has low embedding efficiency and consumes encryption keys in addition. The extraction process of other algorithms depends on extracting information from the plaintext data after decryption. Summary of the invention

[0008] In view of the shortcomings of the prior art, the present invention proposes a ciphertext domain directly readable lossless information hiding method and system based on LWE, which has high accuracy and good security through the LWE encryption and decryption and ciphertext embedding and extraction process.

[0009] To achieve the above object, the present invention provides the following solutions:

[0010] The ciphertext domain direct-readable lossless information hiding method based on LWE includes the following steps:

[0011] Obtain the ciphertext image, decrypt it using the LWE algorithm, and obtain the quantized vector for plaintext mapping;

[0012] Perform redundancy analysis on the value range of the quantized vector;

[0013] Based on the results of redundancy analysis, the ciphertext image is losslessly embedded to obtain the secret ciphertext;

[0014] Based on the secret ciphertext, information is extracted from the ciphertext image or the ciphertext image is decrypted to obtain a lossless plaintext image.

[0015] Preferably, the method for obtaining the ciphertext image includes:

[0016] The l-bit plaintext bit encrypted by the sender is p t ∈{0,1} l , the encryption key is (P,A,r t ), where P is the public key of the LWE system, A is an independent and identically distributed uniform random matrix, r t is a pseudo-random sequence;

[0017] Use stream encryption method to encrypt the real plaintext information, specifically: convert the plaintext p t and r t Perform XOR operation to obtain the sequence to be encrypted m∈{0,1} l , the expression is: Where m=(m 1 ,m 2 ,...,m l ),m i ∈{0,1} is used for LWE encryption;

[0018] Generate a random sequence a∈{0,1} d ;

[0019] Based on the sequence to be encrypted m∈{0,1} l and the random sequence a∈{0,1} d , output ciphertext Among them, c is the ciphertext, q is the modulus, and n is the security parameter.

[0020] Preferably, the method of decrypting the ciphertext using the LWE algorithm to obtain a quantization vector for plaintext mapping includes:

[0021]

[0022] Among them, c is the ciphertext, m is the encrypted bit, S is an independent and identically distributed uniform random matrix, E is the noise matrix, and q is the modulus.

[0023] Preferably, the method for performing redundancy analysis on the value range of the quantization vector includes:

[0024] Presuppose a circle represents a finite field The set of points on ;

[0025] Finite field It is divided into 4 areas, which are: and

[0026] If the point corresponding to the value in the quantization vector is located in area I or IV, it is decrypted to 0; if the point corresponding to the value in the quantization vector is located in sub-area II or III, it is decrypted to 1;

[0027] The minimum fluctuation area under the safety requirement is retained as the quantitative fluctuation area, and then the area within a region excluding the quantitative fluctuation area is the redundant buffer;

[0028] The noise sampling variance is used to limit the quantization vector to the quantization fluctuation area. The noise fluctuation area is recorded as l ip , the minimum length of the QFR region is l ip , then the total area length of the redundant buffer is recorded as l all ow=q / 4-l ip , used for embedding modification, assuming that b-binary information is embedded, the entire redundant buffer is divided into b sub-regions, and the length of each sub-region is l step ,in

[0029] Preferably, based on the result of the redundancy analysis, the method of losslessly embedding the ciphertext image to obtain the secret ciphertext includes:

[0030] Introduce the direction parameter vector flag to mark the modification direction as positive or negative;

[0031] If the normal fluctuation range of noise and the embedding step size are Then the ciphertext is modified at most b-1 times, that is, the embedded information is a b-ary number from {0,1,…,b-1}, realizing multi-bit embedding;

[0032] Specifically: the preset additional information is z∈{0,1,...,b-1} l , the embedded key is (flag,r e ); Use the key r to convert the additional information z e Scramble them and get the result of bit-wise XOR of the two, denoted as w∈{0,1,...,b-1} l , the expression is: Where w=(w 1 ,w 2 ,...,w l ),w j∈{0,1,...,b-1} is used for subsequent embedding, j=1,2,3,...l;

[0033] Calculate the embedded value of each element in the quantization vector h, and determine the position of each element in the quantization vector h on the circumference;

[0034] Based on the position of each element in the quantized vector h on the circumference, calculate flag = (f 1 ,f 2 ,...,f l ),f j ∈{-1,+1}, the expression is:

[0035]

[0036] According to the current ciphertext c j Get the sub-region number, recorded as lab j :

[0037] lab j =(floor(c j / l step ))mod b;

[0038] According to lab j and the additional information w to be embedded j When calculating the embedded modification along the flag direction, the ciphertext c j The number of embedded wavelengths that need to be moved:

[0039] Δt=(f j ·(w j -lab j ))modb;

[0040] Based on the direction parameter vector flag, the sub-region number and the number of embedded wavelengths, the ciphertext c'=(c 1 ',c 2 ',...,c l ') T , where c j '=c j +f j ·Δt·l step ,(j=1,2,…,l), where l step is the embedding step size.

[0041] Preferably, based on the secret ciphertext, the method for decrypting the ciphertext image to obtain the lossless plaintext image includes:

[0042] Use the decryption key (S,r t ) To decrypt the pseudo ciphertext (u, c'), first calculate the quantization vector: h' = c'-ST u, according to the decryption mapping rule, the decryption result m'∈{0,1} is obtained l ,m'=(m 1 ',m 2 ',...,m l ') T ,in,

[0043]

[0044] Based on the decryption result m'∈{0,1} l , recover the plaintext bit p t ';

[0045]

[0046] Preferably, based on the secret ciphertext, the method for extracting information from the ciphertext image includes:

[0047] Calculate the secret ciphertext (c 1 ',c 2 ',...,c l ') T The sub-region number of each ciphertext is the embedded information w j ':in,

[0048] w j '=(floor(c j ' / l step ))mod b;

[0049] Based on the embedded information w j ', recover the extra information z': where,

[0050]

[0051] The present invention also provides a ciphertext domain directly readable lossless information hiding system based on LWE, comprising: a mapping module, an analysis module, an embedding module and a decryption module;

[0052] The mapping module is used to obtain a ciphertext image, decrypt the ciphertext image using an LWE algorithm, and obtain a quantized vector for plaintext mapping;

[0053] The analysis module is used to perform redundancy analysis on the value range of the quantization vector;

[0054] The embedding module is used to losslessly embed the ciphertext image based on the result of the redundancy analysis to obtain the secret ciphertext;

[0055] The decryption module is used to extract information from the ciphertext image or decrypt the ciphertext image to obtain a lossless plaintext image based on the secret ciphertext.

[0056] Compared with the prior art, the present invention has the following beneficial effects:

[0057] The present invention discloses a method and system for directly readable lossless information hiding in a ciphertext domain based on LWE, comprising the following steps: obtaining a ciphertext image, decrypting the ciphertext image using an LWE algorithm, and obtaining a quantization vector for plaintext mapping; performing redundancy analysis on the value range of the quantization vector; based on the result of the redundancy analysis, losslessly embedding the ciphertext image to obtain a secret-carrying ciphertext; based on the secret-carrying ciphertext, extracting information from the ciphertext image or decrypting the ciphertext image to obtain a lossless plaintext image. The present invention has high accuracy and good security through the LWE encryption and decryption and ciphertext embedding and extraction process. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solution of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0059] Figure 1 The finite field ￠ of the embodiment of the present invention q Schematic diagram;

[0060] Figure 2 This is a schematic diagram of a quantized variable range redundancy analysis according to an embodiment of the present invention;

[0061] Figure 3 A schematic diagram of quantization and embedding of ciphertext value range according to an embodiment of the present invention;

[0062] Figure 4 Schematic diagram of a receiving-end deniable image encryption application architecture according to an embodiment of the present invention.

[0063] Figure 5 For the embodiment of the present invention q Schematic diagram of the embedding method;

[0064] Figure 6 The ciphertext field ￠ of the embodiment of the present invention q Schematic diagram of the embedding method;

[0065] Figure 7 Schematic diagram of the algorithm process of an embodiment of the present invention, wherein (a) is plain text, (b) is additional information, (c) is cipher text, (d) is decryption result, (e) is extracted information, and (f) is flag;

[0066] Figure 8 It is a schematic diagram of an example of embedded information in a 50×30 data matrix according to an embodiment of the present invention;

[0067] Fig. 9 A schematic diagram of a plain text example in a 50×30 data matrix according to an embodiment of the present invention;

[0068] Fig.10 Schematic diagram of an original ciphertext example in a 50×30 data matrix according to an embodiment of the present invention;

[0069] Fig.11 It is a schematic diagram of an example of a secret ciphertext in a 50×30 data matrix according to an embodiment of the present invention;

[0070] Fig.12 It is a schematic diagram of a Flag example in a 50×30 data matrix according to an embodiment of the present invention;

[0071] Fig.13 This is a schematic diagram of an example of sub-region numbering where original ciphertext is located in a 50×30 data matrix according to an embodiment of the present invention;

[0072] Fig.14 Schematic diagram of an example of numbering sub-regions where secret ciphertext is located in a 50×30 data matrix according to an embodiment of the present invention;

[0073] Fig.15 Schematic diagram of the comparison of the histograms of the ciphertext data before and after embedding in Experiment 1 of the embodiment of the present invention, wherein (a) is the original ciphertext histogram, and (b) is the secret-carrying ciphertext histogram;

[0074] Fig.16 Schematic diagram of the comparison of histograms of ciphertext data before and after embedding in Experiment 2 of an embodiment of the present invention, wherein (a) is the original ciphertext histogram, and (b) is the secret-carrying ciphertext histogram;

[0075] Fig.17 Schematic diagram of the comparison of the histograms of the ciphertext data before and after embedding in Experiment 3 of the embodiment of the present invention, wherein (a) is the original ciphertext histogram, and (b) is the secret-carrying ciphertext histogram;

[0076] Fig.18 It is a flowchart of a method for directly readable lossless information hiding in a ciphertext domain based on LWE according to an embodiment of the present invention;

[0077] Fig.19 A schematic diagram of the decryption accuracy of encrypting 240 sets of data and embedding them according to an embodiment of the present invention;

[0078] Fig. 20 This is a schematic diagram of the extraction accuracy of encrypting 240 sets of data and embedding them according to an embodiment of the present invention. DETAILED DESCRIPTION

[0079] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0080] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0081] Embodiment 1

[0082] like Fig.18 As shown, the present invention provides a ciphertext domain directly readable lossless information hiding method based on LWE, comprising the following steps:

[0083] Obtain the ciphertext image, decrypt it using the LWE algorithm, and obtain the quantized vector for plaintext mapping;

[0084] Perform redundancy analysis on the value range of the quantized vector;

[0085] Based on the results of redundancy analysis, the ciphertext image is losslessly embedded to obtain the secret ciphertext;

[0086] Based on the secret ciphertext, information is extracted from the ciphertext image or the ciphertext image is decrypted to obtain a lossless plaintext image.

[0087] In this embodiment, the decryption process of the LWE algorithm is a probabilistic decryption, c is the ciphertext, and the quantization vector for plaintext mapping can be obtained by using the private key s. a∈{0,1} d It is a random sequence generated during the encryption process, u is a part of the ciphertext, where c will be used to obtain the pseudo-ciphertext c' through the pseudo-encryption algorithm in the future, and u remains unchanged;

[0088] The values ​​of the variables in this vector revolve around 0 or Fluctuation, the fluctuation value is E T a, obeys discrete Gaussian distribution. When the encrypted bit m is 0, it fluctuates around 0, and when the encrypted bit m is 1, it fluctuates around fluctuation.

[0089] Therefore, its decryption mapping rule is as follows Figure 1 As shown, this circle represents a finite field The finite field is divided into 4 regions, namely: and If the point corresponding to the value in the quantization vector is located in area I or IV, the decryption is 0. If the point corresponding to the value in the quantization vector is located in sub-area II or III, the decryption is 1. The above quantization process is the decryption process of the plaintext bit.

[0090] In this embodiment, regarding the ciphertext redundancy analysis, by limiting the Figure 1 , we can know that according to the decryption quantization rule of LWE, the fluctuation of the quantization vector within a region does not affect the correctness of decryption. In fact, in the encryption process, the fluctuation range of the noise can be controlled by the sampling variance of the introduced noise during the initial setting of the encryption system. The smaller the variance value, the smaller the fluctuation range. Figure 2 As shown in , we can divide each area equally into two parts, namely the quantization fluctuation area and the redundant buffer. The noise sampling variance is used to limit the quantization vector to only be in the quantization fluctuation area. That is, Figure 2 At the midpoints A and B. At this point, even if we add The operation of moving point A to A' does not affect the decryption result. Similarly, the quantized vector at point B is subtracted. The operation moves point B to B' without affecting the decryption result.

[0091] Thus, we can achieve embedded redundancy by modifying the ciphertext. That is, after determining the region where the quantization vector of a ciphertext is located, the ciphertext can be modified. The impact of the modification on the quantization vector will not cause the quantization vector to overflow the window buffer of the region where it is located, thus ensuring lossless decryption. At the same time, the modification process can be used to embed additional information.

[0092] by Figure 2 For example, the encryption process allows the ciphertext to be modified by Since the encryption process of the LWE system is in the same value range, we can divide the space where the ciphertext is located into zone 0 and zone 1 in sequence. The ciphertext is in zone 0, which means that the secret bit it carries is 0; zone 1 means that the ciphertext message it carries is 1. When extracting the message, there is no need to use the key to decrypt the ciphertext. You only need to focus on the area where the ciphertext is located to extract the information. Figure 3 In the example, let the quantized variable point A come from the ciphertext C A ,Right now Figure 3 Midpoint C A . Then the area where point A is located allows the ciphertext to move in the clockwise direction The length of C will not affect the correctness of decryption. A Located in zone 0. If we want to A If an extra bit 0 is embedded in C, the ciphertext remains unchanged. If an extra bit 1 is embedded, the ciphertext needs to be moved so that it is located at C A ', C A'Located in District 1.

[0093] Similarly, suppose the quantized variable point B comes from the ciphertext C B ,Right now Figure 3 Midpoint C B Quantization variable B allows the ciphertext to change in a counterclockwise direction C B Located in zone 0. If the embedded bit is 0, the ciphertext C B unchanged, if the embedded bit is 1, then the ciphertext C B Change in counterclockwise direction Arrival C B '.

[0094] In this embodiment, according to the above analysis, the embedding principle comes from the redundant space of the quantization vector in the decryption process. When the quantization vector does not overflow during the change process, the quantization vector in the same area can ensure the correctness of decryption. In addition, since there is a linear relationship between the ciphertext and the quantization vector in the decryption process of the LWE algorithm, the redundancy of the quantization vector is retained in the ciphertext data, and the ciphertext data can be directly modified to carry additional information.

[0095] To ensure the lossless decryption, there are two problems:

[0096] 1. The direction of the ciphertext modification during the embedding process. According to the LWE algorithm, the quantization vector is centered around 0 and Fluctuation, so the modification direction of the quantization vector in area I and III is positive, that is, clockwise in the figure. The modification direction allowed for the quantization vector in area II and IV is negative, that is, counterclockwise in the figure. We introduce the direction parameter vector flag to mark whether the modification direction is positive or negative.

[0097] 2. Embedding step size and embedding bit size. It is related to the controllable range of noise. Figure 2-3 In the example, we set the normal fluctuation range of noise to The embedding step length when we divide the value range space of the ciphertext is When modifying the quantization vector in a region, it can be changed at most once in one direction. The number of embedded bits is 1. Assume that the number to be embedded is a b-ary number, and the number of embedded logs is 1. 2 b bits of additional information. If the normal fluctuation range of the noise is equal to the embedding step size Then we can modify the ciphertext at most b-1 times, that is, the embedded information is a number from {0,1,…,b-1}. This allows multi-bit embedding.

[0098] The specific implementation process of this embodiment: the algorithm application architecture is as follows: Figure 4As shown in the figure, first, a plaintext image of important information is encrypted into ciphertext and sent to the receiver. For the receiver, the ciphertext usually needs to perform the following two operations: one is to perform relevant processing after decryption. The other is confidentiality management. In the management process, it is usually stored in the form of ciphertext, but the current manager is generally not the same party as the owner of the image content of the important information (i.e., the receiver). Therefore, the receiver provides the manager with a ciphertext image, and in order to facilitate ciphertext retrieval and management, the manager usually requires the receiver to provide auxiliary retrieval tag information, or generate certain attributes and management information by itself. This information can be embedded in the ciphertext using lossless embedding technology to obtain a secret-carrying ciphertext. The secret-carrying ciphertext can directly extract information from the ciphertext for retrieval, management and other operations, or it can be decrypted to obtain a lossless plaintext image for other processing.

[0099] Specifically: Regarding the system parameter setting, (1) the security parameter is n, and other parameters are determined. q is a prime number q∈(n 2 ,2n 2 )≥2, all operations in the LWE encryption system are in a finite field The operation is performed modulo q. The dimension of the vector in the public key space is d(d≥(1+ε)(1+n)log 2 q,ε>0). The introduced LWE noise distribution is This is a discrete Gaussian distribution:

[0100]

[0101] ε is a safety parameter, which can usually be selected as a smaller number. There is no definite value in practice, and the value in this experiment is 0.03. x is a general representation of the elements in a set, which is characterized by rounding each value x from the normal distribution N by q times. "qx" means rounding qx to the nearest integer. is the standard deviation of the selected Gaussian noise distribution, and its value will affect the security of the standard deviation. Specifically, the larger the standard deviation, the stronger the security, but the larger the fluctuation range, the exponentially increasing the computational complexity. If the fluctuation range exceeds q / 4, it will cause decryption overflow. The smaller the standard deviation, the lower the complexity of encryption operation, the more practical the algorithm, and the lower the probability of decryption overflow. However, the encryption security strength provided is low. According to, there is a minimum reference value for the standard deviation: Floor(.) means rounding down the input value, and ceil(.) means rounding up the input value.

[0102] (2) Let the confidence level of decryption correctness be ip (ip = 1-0.03% in this algorithm, i.e., the decryption correctness is guaranteed with a probability of not less than 99.97%), and the fluctuation range of the noise be recorded as lip , so we can get the minimum length of the QFR region is l ip , then the total area length of the redundant buffer is recorded as l allow =q / 4-l ip . Assume that the embedded information is the integer domain The numbers in. That is, you can embed log 2 b bits of additional information. The embedding step length is recorded as

[0103] Then, the entire ciphertext domain space can be quantized and encoded according to the embedding step size, and b sub-regions can be obtained, which are then encoded from 0 to b-1 in sequence. Figure 5 As shown, the total length of the RBR region is q / 6. In the information to be embedded, b=4, l step =q / 24. Therefore, the ciphertext domain space can be divided into 24 equal parts, which are encoded in sequence as sub-region 0, sub-region 1, sub-region 2, sub-region 3, sub-region 0, sub-region 1, sub-region 2, sub-region 3... Figure 6 shown.

[0104] Specifically, regarding key generation, generate an independent and identically distributed random matrix and Generate a noise matrix that follows the distribution χ in formula (1 Get the public key of the LWE system and

[0105] Generate two pseudo-random sequences for encrypting plaintext and additional information: r t ∈{0,1} l ,r e ∈{0,1} l , where l is the number of bits encrypted at one time.

[0106] Specifically, regarding key distribution, in this paper, the keys are distributed as shown in Table 1 according to their functions in the proposed system.

[0107] Table 1 Key distribution

[0108]

[0109] Below, we take the example of encrypting a 1-bit authentic plaintext to introduce the algorithm process:

[0110] Specifically, regarding encryption, the l-bit plaintext bit encrypted by the sender is p t ∈{0,1} l , the encryption key is (P,A,r t ).

[0111] 1) First, use the stream encryption method to encrypt the plaintext information. t and r t Perform XOR operation to obtain the sequence to be encrypted m∈{0,1} l as follows:

[0112]

[0113] Where m=(m 1 ,m 2 ,...,m l ),m i ∈{0,1} is used for LWE encryption.

[0114] 2) Generate a random sequence a∈{0,1} d , output ciphertext The ciphertext is sent to the receiver through an open channel, and the receiver stores the ciphertext confidentially.

[0115] Specifically, regarding embedding, after the receiver calculates the embedding key, it can make the embedding key public to allow any third party to implement the embedding: the additional information is z∈{0,1,...,b-1} l .The embedded key is (flag,r e ).

[0116] 1) Use the key r to convert the additional information z e Scramble them and get the result of bit-wise XOR of the two, denoted as w∈{0,1,...,b-1} l :

[0117]

[0118] w=(w 1 ,w 2 ,...,w l ),w j ∈{0,1,...,b-1} is used for subsequent embedding, j=1,2,3,...l.

[0119] 2) The original ciphertext is (u, c), and the bit to be embedded is w. The embedding process is to proportionally reflect the fluctuation of the quantized vector in its region in the information load area after the ciphertext domain is re-quantized. When embedding information, the elements in the quantized vector need to be moved to a specific information load area. First, the embedded value of each element in the quantized vector h is calculated, and its position on the circumference is determined at the same time:

[0120] i. Calculate quantitative variables h=(h 1 ,h 2 ,...,h l ) T .

[0121] ii. Calculate flag = (f 1 ,f 2 ,...,f l ),f j ∈{-1,+1}:

[0122]

[0123] iii. According to the current ciphertext c j Get the sub-region number, recorded as lab j ::

[0124] lab j =(floor(c j / l step )) mod b (5)

[0125] iv. According to lab j and the additional information w to be embedded j When calculating the embedded modification along the flag direction, the ciphertext

[0126] c j The number of embedded wavelengths that need to be moved:

[0127] Δt=(f j ·(w j -lab j ))modb (6)

[0128] 3) Calculate the ciphertext c' = (c 1 ',c 2 ',...,c l ') T :

[0129] c j '=c j +f j ·Δt·l step ,(j=1,2,…,l) (7)

[0130] Specifically, regarding decryption, under normal circumstances, the decryption key (S, r t ) To decrypt the pseudo ciphertext (u, c'), first calculate the quantization vector: h' = c'-S T u, according to the decryption mapping rule, the decryption result m'∈{0,1} is obtained l ,m'=(m 1 ',m 2 ',...,m l ') T :

[0131]

[0132] Recover the plaintext bit p t ':

[0133]

[0134] Specifically, regarding extracting information, calculating the secret ciphertext (c 1 ',c 2 ',...,c l ') T The sub-region number of each ciphertext is the embedded information w j ':

[0135] w j '=(floor(c j ' / l step ))mod b (10)

[0136] Recover additional information z':

[0137]

[0138] Exemplary, theoretical analysis and experimental results

[0139] A. Correctness

[0140] 1. Parameter setting and algorithm process display

[0141] In this experiment, a binary random matrix of 240×100 plaintext is set: n=240, q=57601, l=256, ε=0.2, =5.379×10 -4 , d = 4573, b = 4.

[0142] The obtained plaintext, ciphertext, secret ciphertext, decryption result and extraction result are as follows: Figure 7 shown.

[0143] 2. Algorithm process examples, such as Figure 8 — Fig.14 shown.

[0144] Below we show a 50×30 example in the experiment. Here, no XOR encryption and decryption operation is performed between plaintext and embedded information. The main purpose is to show the LWE encryption and decryption and ciphertext embedding extraction process. The accuracy of decryption and information extraction is 100%.

[0145] B. Security

[0146] The security of this part mainly considers the statistical distribution characteristics of the ciphertext before and after embedding. The standard ciphertext distribution obeys random uniform distribution. Figure 15-17It can be seen from the figure that the ciphertext distribution after embedding tends to be more uniformly distributed. The ciphertext distribution obtained is closer to the characteristics of random uniform distribution under the condition of maximum entropy. The second is the indistinguishability of true ciphertext and pseudo ciphertext in data distribution. Figure 3 Analyze the characteristics from different angles.

[0147] Figure 19-20 The decryption accuracy of 240 sets of data encrypted and embedded using this patented algorithm ( Fig.19 ) and extraction accuracy ( Fig. 20 ) Statistical chart, where each set of encrypted data is 100 bits, embedded with 100 4-bit numbers. From the experimental results in the figure, it can be seen that the accuracy of decryption and information extraction is 100%.

[0148] Embodiment 2

[0149] The present invention also provides a ciphertext domain directly readable lossless information hiding system based on LWE, comprising: a mapping module, an analysis module, an embedding module and a decryption module;

[0150] The mapping module is used to obtain the ciphertext image, decrypt the ciphertext image using the LWE algorithm, and obtain the quantized vector for plaintext mapping;

[0151] The analysis module is used to perform redundancy analysis on the value range of the quantization vector;

[0152] The embedding module is used to losslessly embed the ciphertext image based on the result of redundancy analysis to obtain the secret ciphertext;

[0153] The decryption module is used to extract information from the ciphertext image or decrypt the ciphertext image to obtain a lossless plaintext image based on the secret ciphertext.

[0154] The embodiments described above are only descriptions of the preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Without departing from the design spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by ordinary technicians in this field should all fall within the protection scope determined by the claims of the present invention.

Claims

1. A ciphertext domain direct-readable lossless information hiding method based on LWE, characterized in that: The following steps are involved: Obtain the ciphertext image, decrypt it using the LWE algorithm, and obtain the quantized vector for plaintext mapping; Perform redundancy analysis on the value range of the quantized vector; Based on the results of redundancy analysis, the ciphertext image is losslessly embedded to obtain the secret ciphertext; Based on the secret ciphertext, information is extracted from the ciphertext image or the ciphertext image is decrypted to obtain a lossless plaintext image.

2. The method for directly readable lossless information hiding in ciphertext domain based on LWE according to claim 1 is characterized in that: Methods for obtaining ciphertext images include: The l-bit plaintext bit encrypted by the sender is p t ∈{0,1} l , the encryption key is (P,A,r t ), where P is the public key of the LWE system, A is an independent and identically distributed uniform random matrix, r t is a pseudo-random sequence; Use stream encryption method to encrypt the real plaintext information, specifically: convert the plaintext p t and r t Perform XOR operation to obtain the sequence to be encrypted m∈{0,1} l , the expression is: Where m=(m1,m2,...,m l ),m i ∈{0,1} is used for LWE encryption; Generate a random sequence a∈{0,1} d ; Based on the sequence to be encrypted m∈{0,1} l and the random sequence a∈{0,1} d , output ciphertext Among them, c is the ciphertext, q is the modulus, and n is the security parameter.

3. The method for directly readable lossless information hiding in ciphertext domain based on LWE according to claim 1 is characterized in that: The method of decrypting the ciphertext using the LWE algorithm to obtain a quantization vector for plaintext mapping includes: Among them, c is the ciphertext, m is the encrypted bit, S is an independent and identically distributed uniform random matrix, E is the noise matrix, and q is the modulus.

4. The method for directly readable lossless information hiding in ciphertext domain based on LWE according to claim 3 is characterized in that: The method of performing redundancy analysis on the value range of the quantized vector includes: Presuppose a circle represents a finite field The set of points on ; Finite field It is divided into 4 areas, which are: and If the point corresponding to the value in the quantization vector is located in area I or IV, it is decrypted to 0; if the point corresponding to the value in the quantization vector is located in sub-area II or III, it is decrypted to 1; The minimum fluctuation area under the safety requirement is retained as the quantitative fluctuation area, and then the area within a region excluding the quantitative fluctuation area is the redundant buffer; The noise sampling variance is used to limit the quantization vector to the quantization fluctuation area. The noise fluctuation area is recorded as l ip , the minimum length of the QFR region is l ip , then the total area length of the redundant buffer is recorded as l allow =q / 4-l ip , used for embedding modification, assuming that b-binary information is embedded, the entire redundant buffer is divided into b sub-regions, and the length of each sub-region is l step ,in 5. The method for directly readable lossless information hiding in ciphertext domain based on LWE according to claim 4 is characterized in that: Based on the results of redundancy analysis, the ciphertext image is losslessly embedded to obtain the secret ciphertext. The method includes: Introduce the direction parameter vector flag to mark the modification direction as positive or negative; If the normal fluctuation range of noise and the embedding step size are Then the ciphertext is modified at most b-1 times, that is, the embedded information is a b-ary number from {0,1,…,b-1}, realizing multi-bit embedding; Specifically: the preset additional information is z∈{0,1,...,b-1} l , the embedded key is (flag,r e ); Use the key r to convert the additional information z e Scramble them and get the result of bit-wise XOR of the two, denoted as w∈{0,1,...,b-1} l , the expression is: Where w=(w1,w2,...,w l ),w j ∈{0,1,...,b-1} is used for subsequent embedding, j=1,2,3,...l; Calculate the embedded value of each element in the quantization vector h, and determine the position of each element in the quantization vector h on the circumference; Based on the position of each element in the quantized vector h on the circumference, calculate flag = (f1, f2, ..., f l ),f j ∈{-1,+1}, the expression is: According to the current ciphertext c j Get the sub-region number, recorded as lab j : lab j =(floor(c j / l step ))mod b; According to lab j and the additional information w to be embedded j When calculating the embedded modification along the flag direction, the ciphertext c j The number of embedded wavelengths that need to be moved: Δt=(f j ·(w j -lab j ))modb; Based on the direction parameter vector flag, the sub-region number and the number of embedded wavelengths, the secret ciphertext c'=(c1',c2',...,c l ') T , where c j '=c j +f j ·Δt·l step ,(j=1,2,…,l), where l step is the embedding step size.

6. The method for directly readable lossless information hiding in ciphertext domain based on LWE according to claim 1 is characterized in that: Based on the secret ciphertext, the method of decrypting the ciphertext image to obtain the lossless plaintext image includes: Use the decryption key (S,r t ) To decrypt the pseudo ciphertext (u, c'), first calculate the quantization vector: h' = c'-S T u, according to the decryption mapping rule, the decryption result m'∈{0,1} is obtained l ,m'=(m1',m2',...,m l ') T ,in, Based on the decryption result m'∈{0,1} l , recover the plaintext bit p t '; 7. The method for directly readable lossless information hiding in ciphertext domain based on LWE according to claim 1 is characterized in that: Based on the secret ciphertext, the method of extracting information from the ciphertext image includes: Calculate the secret ciphertext (c1',c2',...,c l ') T The sub-region number of each ciphertext is the embedded information w j ':in, w j '=(floor(c j ' / l step ))mod b; Based on the embedded information w j ', recover the extra information z': where, 8. A ciphertext domain directly readable lossless information hiding system based on LWE, characterized in that: include: A mapping module, an analysis module, an embedding module, and a decryption module; The mapping module is used to obtain a ciphertext image, decrypt the ciphertext image using an LWE algorithm, and obtain a quantized vector for plaintext mapping; The analysis module is used to perform redundancy analysis on the value range of the quantization vector; The embedding module is used to losslessly embed the ciphertext image based on the result of the redundancy analysis to obtain the secret ciphertext; The decryption module is used to extract information from the ciphertext image or decrypt the ciphertext image to obtain a lossless plaintext image based on the secret ciphertext.

Images